rpm2cpio doesn't show every file included in the RPM package

Question

The "whois" package uses the Linux "alternatives" system (because maybe jwhois is an alternative?) It seems to package /usr/bin/whois as a symlink, but it's not clear how that is done. Running rpm -qp --list whois-5.5.1-2.el8.x86_64.rpm gives this:

/etc/whois.conf
/usr/bin/whois
/usr/bin/whois.md
...more files...

However rpm2cpio whois-5.5.1-2.el8.x86_64.rpm | cpio -itv shows all the files from the previous command except /usr/bin/whois.

Running rpm -qf /usr/bin/whois shows that file is indeed provided by the whois package, which does use the alternatives system as can be seen by running rpm -qp --scripts whois-5.5.1-2.el8.x86_64.rpm which includes:

postinstall scriptlet (using /bin/sh):
/usr/sbin/update-alternatives \
    --install /usr/bin/whois \
        whois /usr/bin/whois.md 30 \

However, that does not explain why /usr/bin/whois does not appear in the cpio archive. I have 2 theories, but I don't know how to determine which, if any is the correct one:

1. The file /usr/bin/whois is "special" in the RPM so it doesn't appear in rpm2cpio; or
2. Cpio detects that /usr/bin/whois is a symlink that doesn't point to another file in the archive, and thus does not list it.

This is information gathering about the Linux "alternatives" system. I wish to make my own "alternative", but I don't know if I should include the symlink in the RPM.

Answer 1

The file /usr/bin/whois is actually not included in the RPM. It is generated by the call to /usr/sbin/update-alternatives.

It appears to be included because of a %ghost directive in the spec file. This ensures that it will be removed on uninstall.

Multiple packages can specify the same file with the %ghost directive, and rpm -qf will show that they belong to both packages, and thus will be removed only when both packages are uninstalled.